logstash[.]in

Analysis of logstash.in indicates active brand impersonation targeting Google. The domain was registered on February 19, 2025, through Endurance International Group India Private Limited and remains operational as of July 12, 2026. It resolves to IP 142.251.156.119, hosted on AS49453 (Global Layer B.V., Netherlands), and uses Cloudflare nameservers (elliott.ns.cloudflare.com, jen.ns.cloudflare.com). The page title explicitly displays 'Google,' aligning with the reported scam type of brand impersonation. Security telemetry shows the domain appears on one blocklist, while AlienVault OTX records it in seven threat intelligence pulses. VirusTotal reports 16 detections from 91 security vendors, confirming malicious classification. The domain presents a valid SSL certificate issued by Let's Encrypt (YR1), which may be leveraged to appear legitimate. Defenders should treat logstash.in as high-risk infrastructure and implement blocking at DNS or proxy layers. No evidence suggests the domain hosts additional payloads, but its active status and brand-mimicking behavior warrant immediate containment. Further investigation into associated IPs or registrant patterns may reveal broader campaign linkages.